VendorsEsriarcgis_serverall versions
Vulnerabilities

Esri ArcGIS Server

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

69CVEs
CVE-2023-25848
BUG-000158039 - There is an information disclosure issue in ArcGIS Server.
Published 2023-08-25 · Modified
5.3EPSS 0.003
CVE-2024-51958
Directory traversal vulnerability in the admin api for service thumbnails
Published 2025-03-03 · Modified
4.9EPSS 0.006
CVE-2024-51966
Directory traversal vulnerability in ArcGIS Server
Published 2025-03-03 · Modified
4.9EPSS 0.006
CVE-2024-51957
Stored XSS vulnerability in ArcGIS Rest Services Directory
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-10904
Stored XSS in Server Admin API
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51942
Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51944
Stored XSS in Rest Services Directory
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51945
Stored XSS issues in Server Admin API
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51946
Stored XSS in Rest Services Directory under Identify operation
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51947
Stored XSS vulnerability in Rest Services under Layer name
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51948
Stored XSS vulnerability in Rest Services under Job ID
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51949
Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51950
Stored XSS in Server Admin under Services > lifecycleinfos
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51951
Stored XSS in Server Admin API
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-5888
Stored XSS in Rest Services API for a Toolbox published as GP Service
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51963
Stored XSS in ArcGIS Server Manager
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51952
Stored XSS issue in ArcGIS Server
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51953
Stored XSS in ArcGIS Server Rest services
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51960
Stored XSS in ArcGIS Server Administrator Directory
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51959
Stored XSS issue in Server Admin API
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2024-51956
Stored XSS vulnerability in ArcGIS Server Administrator Directory
Published 2025-03-03 · Modified
4.8EPSS 0.003
CVE-2021-29113
Remote file inclusion vulnerability in ArcGIS Server help documentation
Published 2021-12-07 · Modified
4.7EPSS 0.008
CVE-2026-2813
Unvalidated Redirect in ArcGIS Server
Published 2026-05-20 · Analyzed
4.7EPSS 0.003
CVE-2014-5121
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Published 2014-08-22 · Modified
4.3EPSS 0.024
CVE-2014-9741
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Desktop, ArcGIS for Engine, and ArcGIS for Server 10.2.2 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Published 2015-07-08 · Modified
4.3EPSS 0.018
CVE-2013-5221
The mobile-upload feature in Esri ArcGIS for Server 10.1 through 10.2 allows remote authenticated users to upload .exe files by leveraging (1) publisher or (2) administrator privileges.
Published 2013-09-24 · Modified
3.5EPSS 0.011
CVE-2013-7231
Cross-site scripting (XSS) vulnerability in the Mobile Content Server in ESRI ArcGIS for Server 10.1 and 10.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-5222.
Published 2013-12-30 · Modified
3.5EPSS 0.011
CVE-2013-5222
Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Published 2013-12-30 · Modified
3.5EPSS 0.011
CVE-2023-25840
BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory
Published 2023-07-21 · Modified
3.4EPSS 0.005
← Prev2 / 2